Encryption & DNS
Oblivious DoH, DNSCrypt, and the difference between privacy and anonymity
Short version: DoH encrypts your DNS queries so network observers cannot read them. But the resolver still decrypts requests and therefore sees who asked for what. ODoH removes that linkage. Combined with DNSCrypt, you get both privacy and anonymity.
How DNS works — simple
When you open a website your device asks “what IP is example.com?” That question travels to a DNS resolver which answers with an IP address. By default that question is plaintext. Anyone on the path (ISP, Wi‑Fi operator, VPN endpoint) can read it. They can log and sell the data.
DoH (DNS-over-HTTPS): what it fixes, and what it doesn't
DoH encrypts the channel between your device and a resolver (like Cloudflare's 1.1.1.1). That protects DNS queries from network eavesdroppers and public Wi‑Fi sniffing. It also prevents passive ISP collection of DNS payloads.
Why DoH is still vulnerable
- DoH hides the query on the wire, but the resolver that answers must decrypt it.
- That resolver sees the domain, the requester IP, and timing data. It can log or share them.
- DoH alone gives you privacy from on-path observers; it does not provide anonymity from resolvers.
ODoH (Oblivious DoH): how it fixes the resolver link
ODoH separates the act of transporting the encrypted DNS query from the act of answering it. A relay (proxy) forwards an encrypted request to a resolver without learning its contents. The resolver can answer but cannot tell which client asked. This removes the resolver→client link.
Analogy
Imagine putting a letter into a locked drop-box. A courier takes the locked letter to a processing office. The office can open the letter and prepare the reply, but the courier doesn't read the letter and the office cannot identify which courier-owner dropped it. ODoH is the locked letter + courier.
The formal specification is RFC 9230. See Cloudflare's developer guide for a practical description:RFC 9230 ·Cloudflare ODoH guide.
DNSCrypt + ODoH: why the combination matters
DNSCrypt is a protocol that authenticates and encrypts DNS traffic between a client and resolver. It prevents tampering and proves the resolver’s identity. ODoH removes the resolver→client IP link. Together they provide:
- Privacy at the wire: encryption hides queries from on-path observers.
- Anonymity from resolvers: ODoH prevents the resolver from knowing who asked.
- Integrity and auth: DNSCrypt prevents spoofing and ensures the resolver is authentic.
How this differs from DoH
DoH = wire privacy only. DNSCrypt+ODoH = wire privacy + resolver anonymity + resolver authentication.
How Cloudflare helps
Cloudflare implements ODoH and provides both a production relay and resolver infrastructure. Their guide describes practical trade-offs, performance, and deployment patterns. We use these patterns as a baseline for our managed offering.
Cloudflare: 1.1.1.1 — Oblivious DoH
Why we will not support DoT or DoQ
DoT and DoQ are valid encrypted transport options. We prefer DNSCrypt+ODoH because:
- DNSCrypt provides strong resolver authentication and is widely deployed for client implementations we target.
- ODoH addresses resolver anonymity — a requirement DoT/DoQ alone do not solve.
- DoQ adoption and middlebox handling are still fragmented; modern firewalls and platforms handle DNSCrypt+ODoH well for our use cases.
What Bloqr will do for you
- We enable encrypted DNS by default for all customers.
- DoH remains available as a compatibility fallback (legacy clients).
- By default we prefer DNSCrypt + ODoH for both privacy and anonymity. You do nothing.
- We document the implementation and provide a transparent audit log of trusted relays and resolvers.
References & further reading
- RFC 9230 — Oblivious HTTP (spec)
- Cloudflare — Oblivious DoH (guide)